Malware Freak Show 3: They're pwning er'bodey out there!
This is a modal window.
Das Video konnte nicht geladen werden, da entweder ein Server- oder Netzwerkfehler auftrat oder das Format nicht unterstützt wird.
Formale Metadaten
Titel |
| |
Serientitel | ||
Anzahl der Teile | 122 | |
Autor | ||
Lizenz | CC-Namensnennung 3.0 Unported: Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen. | |
Identifikatoren | 10.5446/40607 (DOI) | |
Herausgeber | ||
Erscheinungsjahr | ||
Sprache |
Inhaltliche Metadaten
Fachgebiet | ||
Genre | ||
Abstract |
|
DEF CON 1939 / 122
3
5
10
11
12
22
23
24
30
31
32
38
43
46
47
49
51
54
56
59
60
62
71
73
76
84
85
88
92
93
96
97
98
104
106
109
112
113
115
119
00:00
DatenverwaltungMathematikSelbst organisierendes SystemSoftwareFunktion <Mathematik>HalbleiterspeicherIterationBildschirmfensterVideokonferenzSoftwaretestProgrammierumgebungTaskAggregatzustandBitPhysikalisches SystemFestplatteQuick-SortVersionsverwaltungGüte der AnpassungBasis <Mathematik>Prozess <Informatik>VerzeichnisdienstSystemverwaltungWurzel <Mathematik>ComputersicherheitPunktLesen <Datenverarbeitung>ChiffrierungUmwandlungsenthalpieElektronische PublikationSchlüsselverwaltungAutorisierungMalwareLoginMinimalgradEinfache GenauigkeitMultiplikationsoperatorRechter WinkelSmartphoneDemo <Programm>Mobiles InternetSoftwareentwicklerAnalysisDatenverwaltungFunktion <Mathematik>HalbleiterspeicherIterationVideokonferenzTaskPhysikalisches SystemStichprobenumfangWasserdampftafelProzess <Informatik>Metropolitan area networkInstantiierungComputersicherheitInformationsspeicherungChiffrierungUmwandlungsenthalpieVerkehrsinformationQuellcodePlastikkarteElektronische PublikationClientSchreib-Lese-KopfAutorisierungMini-DiscMalwareEvoluteExploitComputerforensikDemo <Programm>SoftwareentwicklerComputeranimation
07:11
AnalysisCodeDatenbankDatenverwaltungSelbst organisierendes SystemSoftwareStabZeichenketteFunktion <Mathematik>HalbleiterspeicherBildschirmfensterEchtzeitsystemProgrammierumgebungBinärcodeMereologiePhysikalisches SystemVersionsverwaltungServerVerzeichnisdienstInstantiierungFiletransferprotokollComputersicherheitPunktQuaderInformationsspeicherungKernel <Informatik>ChiffrierungKartesische KoordinatenUmwandlungsenthalpiePlastikkartePuffer <Netzplantechnik>Elektronische PublikationPasswortWeb SiteSchlüsselverwaltungMini-DiscNeuroinformatikMalwareEvoluteMultiplikationsoperatorRechter WinkelDemo <Programm>Twitter <Softwareplattform>PortscannerAlgorithmusBildgebendes VerfahrenCodeSelbst organisierendes SystemSoftwareFunktion <Mathematik>HackerHalbleiterspeicherDatenkompressionEntscheidungsmodellMAPBildschirmfensterFunktionalMaßerweiterungPhysikalisches SystemProzessautomationReelle ZahlSpannweite <Stochastik>Prozess <Informatik>FiletransferprotokollCodierung <Programmierung>InformationsspeicherungKernel <Informatik>ChiffrierungSchnitt <Mathematik>Puffer <Netzplantechnik>Elektronische PublikationPasswortMini-DiscMalwareEvoluteKreisbogenMultiplikationsoperatorComputerforensikRootkitComputeranimation
13:59
MereologieGrundsätze ordnungsmäßiger DatenverarbeitungMultiplikationsoperatorDemo <Programm>KreisringIntelligentes NetzSpitze <Mathematik>Computeranimation
14:57
BinärcodeMultiplikationsoperatorComputeranimation
15:32
BildschirmfensterBinärcodeKartesische KoordinatenMalwareComputeranimation
16:15
TypentheorieBildschirmfensterVerzeichnisdienstMalwareDienst <Informatik>Vorlesung/Konferenz
16:54
SoftwareSI-EinheitenProzess <Informatik>PunktInformationsspeicherungMini-DiscMalwareSoftwarePROMQuarkmodellRechenwerkQuilt <Mathematik>
18:21
HardwareSoftwarePlasmabildschirmRadikal <Mathematik>Virtuelle MaschineZentralisatorServerProzess <Informatik>MagnetkarteFiletransferprotokollPunktInformationsspeicherungPlastikkarteElektronische PublikationWeg <Topologie>TouchscreenMalwareCodeHackerTypentheorieGesetz <Physik>ServerMagnetkarteInformationsspeicherungThreadKonfigurationsdatenbankPlastikkartePuffer <Netzplantechnik>Mini-DiscSystemplattformMalwareComputeranimation
19:52
CodeInformationFunktion <Mathematik>SoftwaretestInhalt <Mathematik>Grundsätze ordnungsmäßiger DatenverarbeitungFinite-Differenzen-MethodeServerNetzadresseSkriptspracheElektronische PublikationStreaming <Kommunikationstechnik>MalwareDickeDemo <Programm>Funktion <Mathematik>Hill-DifferentialgleichungStreaming <Kommunikationstechnik>Computeranimation
21:26
Funktion <Mathematik>VerzeichnisdienstSkriptspracheElektronische PublikationMalwareStatistikFunktion <Mathematik>ComputeranimationVorlesung/Konferenz
22:11
MagnetkarteInformationsspeicherungQuellcodePlastikkartePuffer <Netzplantechnik>Mini-DiscMalwareZweiChiffrierungVorlesung/Konferenz
22:58
SoftwareHalbleiterspeicherTypentheorieProgrammierumgebungBitPhysikalisches SystemQuick-SortTeilbarkeitCoprozessorCoxeter-GruppePlastikkarteSchreib-Lese-KopfDifferenteMini-DiscMalwareCodeSyntaktische AnalyseFunktion <Mathematik>HackerHalbleiterspeicherTypentheorieBildschirmfensterLokales MinimumSpeicherabzugStichprobenumfangServerIntelligentes NetzProzess <Informatik>MagnetkarteInformationsspeicherungThreadInstallation <Informatik>KonfigurationsdatenbankPlastikkarteMini-DiscSystemplattformMalwareComputeranimation
24:22
RauschenHalbleiterspeicherBildschirmfensterBandmatrixBinärcodePhysikalisches SystemSpeicherabzugGrundsätze ordnungsmäßiger DatenverarbeitungProzess <Informatik>PunktInformationsspeicherungChiffrierungKartesische KoordinatenMailing-ListePlastikkarteBootenMalwareMultiplikationsoperatorMessage-PassingDienst <Informatik>Demo <Programm>GamecontrollerEinsSoftware Development KitHalbleiterspeicherSteifes AnfangswertproblemComputeranimation
26:58
CodeCodierungBildschirmfensterPhysikalisches SystemGüte der AnpassungATMInstallation <Informatik>BootenMalwareDienst <Informatik>HalbleiterspeicherHill-DifferentialgleichungSteifes Anfangswertproblem
28:36
AggregatzustandPhysikalisches SystemProzess <Informatik>PunktKartesische KoordinatenMalwareRechter WinkelDatumsgrenzeHalbleiterspeicherComputeranimation
29:56
SpeicherabzugLesen <Datenverarbeitung>Kartesische KoordinatenHilfesystemPlastikkarteWeg <Topologie>Rechter WinkelSpezielle unitäre GruppeComputeranimation
31:26
MathematikFunktion <Mathematik>SkriptspracheElektronische PublikationMalwareMultiplikationsoperatorHalbleiterspeicherPrimzahlzwillingeSchreiben <Datenverarbeitung>Computeranimation
32:24
Funktion <Mathematik>HalbleiterspeicherProzess <Informatik>ChiffrierungSkriptspracheElektronische PublikationSichtenkonzeptTrennschärfe <Statistik>Rechter WinkelComputeranimationProgramm/Quellcode
33:27
HackerHalbleiterspeicherSkriptsprachePlastikkarteMalwareRechter WinkelDualitätstheorieComputeranimationVorlesung/Konferenz
34:00
SystemaufrufPlastikkarteElektronische PublikationMalwareMultiplikationsoperatorDemo <Programm>BenutzerbeteiligungCodeDatensatzSyntaktische AnalyseFunktion <Mathematik>HalbleiterspeicherTypentheorieBildschirmfensterMaßerweiterungRechenwerkSpeicherabzugStichprobenumfangTUNIS <Programm>Prozess <Informatik>FiletransferprotokollInstallation <Informatik>UmwandlungsenthalpieSystemplattformMalwareComputeranimation
34:51
HackerKonfigurationsdatenbankElektronische PublikationMalwareDemo <Programm>BenutzerbeteiligungRechenwerkDateisystemComputeranimation
35:27
SoftwareBildschirmfensterLastStellenringVirtuelle MaschineKonfigurationsdatenbankElektronische PublikationWeb SiteMalwareComputeranimation
36:04
HackerBildschirmfensterPhysikalisches SystemWurzel <Mathematik>InformationsspeicherungElektronische PublikationMalwareDatenverwaltungBildschirmfensterTaskIkosaederComputeranimation
37:02
Attributierte GrammatikInformationTypentheorieBildschirmfensterInhalt <Mathematik>Physikalisches SystemStellenringFiletransferprotokollWeb-SeiteBrowserIntranetElektronische PublikationPasswortMalwareMultiplikationsoperatorSpider <Programm>DualitätstheoriePrimzahlzwillingeRechenwerkStellenringComputeranimation
38:32
FiletransferprotokollWeb-SeiteElektronische PublikationMalwareMultiplikationsoperatorZweiPackprogrammRechenwerkComputeranimation
39:35
CodeChiffrierungSkriptspracheKonvexe HülleSkriptspracheComputeranimation
40:07
Offene MengeChiffrierungSkriptspracheElektronische PublikationInformationFlächeninhaltZeitrichtungMetropolitan area networkCodierung <Programmierung>CAN-BusIntranetSchmelze <Betrieb>Kappa-KoeffizientComputeranimation
40:45
Quick-SortCoxeter-GruppeBrowserAbgeschlossene MengeMalwareMultiplikationsoperatorDemo <Programm>Mobiles InternetCodeDatensatzRoboterZeichenketteTypentheorieBildschirmfensterMaßerweiterungRechenwerkStichprobenumfangFlächeninhaltProzess <Informatik>VorhersagbarkeitFiletransferprotokollUmwandlungsenthalpieFokalpunktInformation ExtractionSystemplattformMalwareMobiles InternetComputeranimation
Transkript: Englisch(automatisch erzeugt)
00:00
So this is Malware Freakshow 3, and I'm Nick, and this is Gibran, and so let's just, let's just jump right in. So instead of, you know, spending time on the agenda, we'll just skip right past that. The inspiration for this talk is basically something called System Intruder, and for those of you who are familiar with Bedroom Intruder,
00:20
there was a parody created by this guy we know named Zach, and we were going to play the song right now, but since we're a little short on time, we're going to save it to the end, and we'll play it for you guys. So, brief introduction, you know, who we are. I'm Nick Percoco, I run the Spider Labs team at Trustwave. I started my career in the 90s doing infosec, started out really doing penetration testing back then.
00:43
This is my fourth DEFCON talk, and I have two more this weekend, one tomorrow and one on Sunday. It's a Droid talk and a mobile SSL talk as well. I'm also the primary author of Trustwave's Global Security Report, so for those of you familiar with that, it's an interesting read. Okay, and I am Gibran Elias, I am the senior forensic investigator at Spider Labs Trustwave.
01:03
I have about nine years of experience, and this is my only talk at DEFCON this year. I've spoken at Black Hat Sector and Source Barcelona before, and I happen to have a master's degree from Northwestern. So, just wanted to brag about that.
01:21
So, really, we want to talk about, you know, why give a freak show? So, what is this talk all about? Well, we perform a lot of investigations on an annual basis. We go into a lot of environments where there's targeted malware, malware that's not, you know, ticking off any bells and whistles from the AV engines that are installed in those environments. And we really wanted to be able to bring live demos to you guys
01:41
and be able to show you what sort of the state of the industry from a malware development standpoint looks like and what the real criminals are using to exfiltrate valuable data out of corporations and other environments. Basically, the real big takeaway here that we see is, you know, the exploit world is basically commoditized.
02:01
You know, the criminals are going after, they want to buy exploits, they want to be able to use those to get into environments, but they're really putting a lot of effort, a lot of development resources into developing malware. It's become a rather big business. They will put money into that industry. They will hire really highly skilled developers to make this malware for them.
02:21
And just as if, if you have a business and you want to create a business piece of software, you may outsource it to some developers and build it to your specifications. They're doing the exact same thing. So, really, what is this talk about? Well, this is the third iteration of this talk. So, has anybody seen any of the other malware freak shows before? Oh, so we got a handful of folks.
02:41
We got frequent freak show points for you at the end, so just to see us. This is the third iteration of this talk. You know, 2009, we demoed a keystroke logger, a custom keystroke logger, a memory dumper, an early, early version of a memory dumper, and a video poker piece of malware, and then a network sniffer. Last year, we demoed another memory dumper, one that got a little bit more advanced,
03:02
some login credential stealers, a network sniffer again, and then a client-side piece of malware that basically targeted PDFs. It was a PDF attack. So, this year, we wanted to bring it a little bit more personal, you know, bring it really home to ourselves and the people who are in the audience, and so we're really talking about some new targets. So, this year, we're talking about your grocery store, you know, places you shop every day, your favorite bar,
03:22
places where you like to get drunk, and your work, and then, of course, your smartphone. So, this is all about you and this iteration of malware freak show. So, when we talk about sort of the evolution, so what have we been seeing? When you talk about evolution, you typically talk about, you know, 50, 100, thousands of years. What we're talking about here is just three, and we've seen a dramatic change in the piece of malware
03:42
that we've been following, the malware authors, the malware that's being used in the various targets that we're talking about over the last just three years. I mean, when we first started following this and putting together this freak show, we saw sloppy malware developers. We saw people that were, you know, just literally testing the waters, trying to basically find ways to exfiltrate data,
04:04
try to automate things that they were trying to do on a manual basis, but it was very, very early on. They were also not being covert, so they were being blatant. We'd see things like NetworkSniffer.exe installed in environments or, you know, MemoryDumper.exe.
04:21
I mean, they were very, very, you know, early, early on. And then also a lot of noisy output files. They would create these files that would be gigantic, especially when we're talking about the memory dumper world. They would dump, you know, 2 gig files to the drives and literally just fill up the hard drives on the systems. And then they were easily detected. You just look in Task Manager in Windows and you can see them. They were blatant in front of you.
04:42
In 2010, they started to get tricky with their file names. It wasn't anything that was super complex, but they were trying to change things to make it a little more difficult for administrators. And you've got to think of a lot of the targets where these criminals are going after. We talked about your grocery store, your favorite bar. These aren't sophisticated IT environments.
05:00
And so all they have to do is fly under the radar of the people who they're targeting. And they're doing a pretty good job of that. They were doing a pretty good job of that in 2010. They were also placing things inside system folders to make it a little bit more obscure. If you place something in the root directory of a drive and you fill it up with a whole bunch of files, someone may find that.
05:21
The attackers found that if they put it in the system32 directory, it's going to be a little bit more obscure. Not for most people in this room, but for the people that they're trying to target, the victims of the criminals who are targeting people. And of course the output was mainly in plain text. You'll see some things in 2011 in the stuff we're going to demo now,
05:41
but mainly they're just putting plain text files. The data they're trying to exfiltrate was just written to disk. No major issues there. The advanced tools that they were using, basically advanced tools that we would use, could easily detect their activity. They were being a little bit more obscure. They may not show up in task manager, but we can detect them. And then automated exfiltration, that's sort of the key. If you're a criminal and you want to attack, say, 25, 30, 100 organizations,
06:04
you're not going to manually connect to those organizations every single day and download the data. You want it to be automated, you want it to send the data to you, just sit back, relax, watch TV, and collect all the data that you can out of these victim organizations. So then when we talk about 2011, so this is a little bit of a preview,
06:20
so I'm not going to go into too much detail, but when we talk about 2011, the malware developers have grown up. Either that or the criminals have decided to pay more money and hire better developers. We saw some really, really interesting techniques this year. Zero storage, so we're talking about them writing files to disk. We're going to show you some examples where there's literally the only footprint that's on the system is the piece of malware.
06:42
There's no evidence of the data that they're actually handling and exfiltrating out of the system. And then where data is stored, they're using encryption to store that data on the system. And they're using more efficient methods. So you hire better developers, you stop having 500k executables and you get them down to just a few k, which makes things much more efficient and much easier to place on systems.
07:02
And then, of course, automation. So automation is everywhere today. We just started seeing inklings of it in 2010, but now today it's basically automated everywhere in the system. So, Gibran, do you want to take some specific pieces of malware, some of the evolution we've been seeing? There are some folks that came to our 2009 and 2010 talks,
07:22
and you guys might realize the notable features. So, like Nick mentioned earlier, 2009, it was just really basic. We were seeing keylogger.exe. NetworkSniffer.exe. So they just didn't care. They knew that once they got into their organizations, they knew that organizations didn't have enough ID staff to even look at those executables.
07:42
The FTP credentials were not packed in the binary. So we could just use strings and we could see all of the malware features, like, okay, what it does, where's the FTP, what is the FTP username and the password. So lots of sloppy work. Output was just plain text .cap file.
08:01
So that kind of tells you that they really didn't care much. Then in 2010, they actually did one better. They started matching, like, you know, svchost.exe. Anybody knows what that is? Okay. So basically, they started naming their malware applications like legitimate Windows names.
08:20
And then output was compressed and password protected. But again, the password was right in the binary. You know, you would see something like rar-hp and then the password. So that was still pretty easy. Nightly auto exfiltration appeared for the first time. I think one of the malware that we demoed last year had that. But the 2011, which I cannot wait to show you guys,
08:42
you're going to have a ball watching these demos. So there's no output on the disk. Like, some of the malware, sniffers that you're going to see is that, you know, malware takes the data in one hand, sends it out from the other. It basically has two buffers. It steals the data and sends it out.
09:00
And basically, it's a real-time exfiltration. And exfiltration is no longer on, like, FTP ports or SMB ports. Exfiltration is on port 80, which, you know, in a lot of even mature organizations, port 80 and 443 are allowed outbound. So the malware writers have realized that and they fully, you know, take advantage of that.
09:21
Encryption and coding output data. That is, like, a really, really key feature trend in 2011. You know, before, you know, as forensic investigators, we would do disk analysis and we would search for, you know, social security data or credit card data and we would, you know, just find it in the disk. You know, there would be a file, and then we would track backwards.
09:40
So now, when they're encrypting the data, those disk scans are useless because all the data that's stored on the disk is basically encrypted or encoded. So that was for the sniffers. The memory dumper, you know, in 2009, we demoed the three executable files and there was basically no anti-forensic capabilities, plain text output right on the root, you know,
10:02
system 32 directory. 2010, single executable, it was a kernel rootkit, so they did get a little smarter, but the output was still in plain text. So, and, you know, the output was, if you had to sort the files, you would actually see the latest date on that output file.
10:21
So you'd still, it's pretty easy to detect still. Now, 2011, you know, it's the return of the three executable files. So it's like a full malware kit, you know. One binary does something, the other binary does the second thing, and the third binary basically completes the package. And we're gonna actually see that. And then, everything is timestamped. So if you're looking for files in like system 32,
10:42
the most recently accessed or most recently modified, you won't get to see it because the malware writers first timestamped the binaries and they match it with the system installation date. So, you know, system 32 directory has a lot of DLLs, right? So if they match those dates, you're probably not gonna doubt those files.
11:01
And last but not the least, that output, again, is encrypted. So you have to actually crack the encryption to figure out what kind of data they're exfiltrating. So what we're talking about the malware landscape today, so this is more continuing on from 2011, so we're seeing some anti-forensics features being built into the malware. I think you just talked about the timestomping component,
11:21
but we see other features as well. And then, of course, the stolen data is encrypted. The encryption algorithms are getting more advanced. I think some of the early versions we just saw, using like XOR to basically encode that data. But we're seeing things more sophisticated there as well. Mainly because if you're an attacker and you're going after a site and you're harvesting a whole bunch of data,
11:42
even if you're storing it locally, you don't want someone else to come along and grab it and steal it from you. So might as well protect the data that you're stealing from those systems. And then, of course, malware as a DLL. We started seeing it. We're going to demo one of those as well for you. So now, like we've seen in previous years, we want to spend a great deal of time in this talk
12:00
doing actual live demos for you. So I'm going to introduce each of these demos, and then Gibran's going to fire up and bring up his VM instance of each environment, and he's going to demo those live for you. So basically what we're talking about here, this is your grocery store. This is a place where all of us probably go to on a weekly basis, buy our milk, buy our butter, and buy our beer.
12:21
And basically, this environment, this is where we see a piece of malware called Cameo. And we're not really sure why the attackers call it Cameo. We see it called Cameo over and over again in a lot of environments. But we gave this guy the code name Best Supporting Actor. Like Gibran talked about, this is a sniffer. This is something that has very little visibility
12:40
on the system itself. And so when you think about a grocery store environment, this is actually pretty sophisticated for some of these environments that we've seen, like the grocery stores and some of the retail environments. This is something that you don't really need to be that sophisticated to target a grocery store. I haven't been to a grocery store that has an IT security person hanging out in the back room. This is just check the cashiers and then the store manager.
13:02
But we see environments where this malware is placed on either a central system in the environment or on all of the lanes. So when you're checking, you're buying your beer and they're scanning it and you hand them your credit card, they're swiping that and literally in real time your data is going from that register across the network out to the attacker systems and they're then archiving that into a database
13:21
and sorting it out for sale almost instantaneously. And part of the things to note is that the grocery stores, sometimes you won't even see Windows computers there. You would see the Ethernet point of sale swipes, right? So obviously this malware is designed for a Windows box.
13:42
So basically all the data that's going across on Ethernet to a server in the manager's room, they want to place that malware there. So this malware has to be at the aggregation point of the data. So with that, you want to bring up the demo? Yeah, let's do it.
14:02
Okay. All right, so this is the exciting part of the talk and I'm hoping I think you all will enjoy it a great deal. So what we're going to do, obviously we have four demos here. Have you guys been to a talk with demos before at DevCon?
14:23
We hear there's a very, very low percentages with the success of the demos. So we're going to do a collective prayer to the demo gods and we're going to do it before each demo. So I have an announcement.
14:41
When I say, what time is it? We all have to say demo time. So that will please the demo gods, right? And this room is packed, so I better hear a huge cheer. And actually, we have an incentive for you guys. So whoever cheers the loudest, not only do we give a SpiderLabs t-shirt, but also a past war party. That's right.
15:01
Awesome. So you did it the first time. There are four times, so you better be awake. Are you guys ready? What time is it? You guys are good in the first time. That's exciting. I think we're going to have a lot of fun.
15:20
As I said, this is a grocery store, right? Does it look like a grocery store? Do you see your common things? Well, it's awesome. So first I want to show you the binary. So the binary is called cameo.exe. I'm going to show you the size.
15:41
This is only a 24 kilobyte binary. And if you mouse over this, you see keyword sniffer MFC applications. That kind of tells me that this is probably an off-the-shelf product, but they modified the code, and then they made it so that it has some anti-forensics features.
16:00
So what I'm going to do is copy this binary to the Windows system32 folder. That's typically where a lot of the malware run from, right? And then we're going to start the command prompt and actually browse through that directory. Everyone following me so far?
16:22
Awesome. Cool. All right, so I'm going to start. So basically to install this malware, you basically just type the malware name. The malware writers, they actually code it so that it's installed as a Windows service. Can anybody tell me what's the advantage of being installed as a Windows service?
16:41
Yeah, so when you reboot the system, the malware comes back. So there you go. I'm going to start cameo.exe. Notice we didn't see anything. The malware is running. So what I want to do now is actually show you... You guys familiar with ProcMon? It's a system internal tools that kind of monitors
17:03
the activities of a process. So I'm going to say that, hey, I only want to monitor whatever cameo.exe is doing. Hit apply, and this is basically it. So as you can see, the malware is running, but it doesn't have any disk activity at this point.
17:22
So I also want to start my Wireshark because remember I told you that this malware actually sends the data outbound on port 80? So we want to see what data actually goes out of the network. So even at Wireshark, I don't want to monitor the whole network, the whole grocery store. So I want to just filter for everything that's going out on port 80.
17:44
Anybody know a filter that we can feed it to Wireshark that just gives us port 80 traffic? TCP.port equals 80, right? So that's what we're going to do. We're going to say, you know what, this is me sniffing the traffic to figure out
18:02
what the malware actually sends out. So I only have one interface, so that's easy. And then I'm going to say TCP.port equals 80. So now the sniffer is only going to show us what goes out on port 80. All right, so now that we have our sniffer set,
18:21
I'm going to jump to my host machine and actually show you a file with credit card data. So that file is basically called check3.txt. So as you can see, there's not only just credit card data,
18:40
but what we call credit card track data, the magnetic stripe data on the back of your credit card. So why this is useful is because if you steal someone's track data, the magnetic stripe data, what you can do is you can code that on your credit card. And then wherever you go, let's say you go to a Best Buy or whatever expensive place,
19:02
you can buy like a $5,000 plasma TV and they'll ask you, hey, show me your ID. So on the front of the card, it's your name, but behind the scenes, this poor victim is going to get charged. So this is the file that I'm going to send on the network and this is the file that the malware is going to intercept.
19:20
So I'm going to log into the FTP server there. So I'm going to send the data on FTP server and then we're going to see the data go out on port 80. So this is very similar to what you see in a grocery store when you swipe a card at a lane in a hardware terminal, it's sending that data to a central processing server. So it's basically what Gibran is going to simulate here. So I'm basically feeding the data to that aggregation point.
19:42
And this happens for all of those grocery shop terminals. So I'm going to say check3.txt, just put it there. And then we're going to go back to our screen here and go back to Wireshark and voila, that worked.
20:01
So the demo gods have answered. So we have this weird looking traffic, right? Some traffic is going to this fdm.php. So right now our attacker server is the internal IP because we didn't want to send the data out, even the test data. So this is basically the packet that we're going to follow
20:21
and see what the output looks like. So I do a right click on it and I go follow TCP stream. So this is basically the packet. As you can see, it's a post and the user agent is Cameo. It's sending it to this IP address. Notice it's an internal IP but in the real world there would be an external IP like in some eastern European country
20:41
that I should not name. Content length. And then this is the data that's going out. So can you see anything? Can you make anything out of this data? Okay, thankfully not. Alright, so I'm going to copy this output. So this is basically the data that's going to the attacker's server.
21:01
So how do we crack this? So we basically, at Spider Labs, our researchers crack the code and we're going to see how this data looks like. So I'm going to go to my Cameo directory, create a new file called malware output. And basically paste the information that I saw in the TCP stream.
21:23
And what I'm going to do now is basically copy a script. It's basically a Perl script called Cameo decoder. Put it here and browse through this directory. Okay, so the way to run it is you basically do cameodecoder.pl.
21:46
That's the Perl script that we wrote to crack that data. And I'm going to feed the malware output.txt. So that's the file that had the encoded data. And then I'm going to say, can you please put all that data in decrypteddata.txt?
22:03
Okay, so the script runs and it basically decrypts the data. Now we have this file that has the encoded data. And now we open the decrypted data. And what do you see here? It's got an IP, source port, then it has that full credit card number,
22:22
actually magnetic stripe data that we saw earlier. Got it? So that's how sophisticated the malwares are getting. As you can see, there's no storage on the disk. It basically takes the data on one buffer and then every 30 seconds it sees, hey, is there data on my right hand?
22:41
If there is, then I'm going to send it from my left hand. So it's kind of like charity, you know? But yeah, so that's it for the Cameo malware. I'm going to turn it over to Nick Percoco and he's going to show you about the second malware. All right, so before we do that, I'm going to set up my snapshot. Okay, let me bring up the presentation.
23:06
Okay. So let's go into the... There we go. Okay, so the next piece of malware that we're going to show you, this is targeting your favorite bar. So obviously I would think everybody here has been to a bar before.
23:21
When you go and you buy a beer, you start up a tab, you hand your credit card to somebody. Basically, your card is being entered into a system and then it's being processed. Similar to what we saw in the grocery store, but that's happening in a bar. And so the type of malware here is different. This is not a network sniffer. This is a memory dumper. Memory dumpers are designed to obtain data while it's in memory,
23:43
as the name sort of tells you. But the big key factor there is that we see this being used in environments where data is being encrypted to a system. It's being encrypted while the data is on disk in the system by design, and then it's being encrypted while it's being sent to, say, an upstream processor or an upstream system. So the criminals sort of scratched their heads for a little while
24:03
and thought, you know, how are we going to get access to this information? And they started developing a memory dumper. And so we call this memory dumper the Son of Brain Drain, because last year I think we demoed Brain Drain. This one's a little bit more advanced. And so to not steal any Gibran Stunner talking about the key features, I think are you up and ready to go for the next demo?
24:20
Yeah, sure. Do you want to do your chant? All right, so the demo gods were very, very, very happy. I just got a message. So we're going to do this again, but this time we're going to do one better. We're going to raise our hands and say demo time. What time is it? You guys look fantastic. Thank you so much. All right, so we're going to start the same way.
24:44
I'm going to show you the binaries. So this is the memory dumper malware kit. So as I mentioned that they have multiple binaries doing the job. So let's see what each of them looks like. There is winboot.exe. So this is basically the controller. This is like the master malware, I would like to call it.
25:02
So this is the one that gets installed as a Windows service, and we already discussed what Windows service does to the malware. It comes back every time system boots up. And when it runs, basically the only job that this piece of executable has is basically starting the two other binaries. So this first binary that you see, CSRSVC.exe,
25:23
that has a list of executable names that are known executables that handle credit card data. So it has the name of the most common point of sale applications. So when you go to a restaurant, you go to a hotel, you go to a bar,
25:41
you see a typical kind of systems. I don't want to name any of the software, but the attackers know about all of them, at least all the popular ones. So they basically say, hey, you know what, rather than dumping the memory of like four gigabytes of the whole computer, we don't want to create that much noise. So what we're going to do is pick those processes
26:02
and just dump the memory for those particular processes. So the footprint is less, and then they delete that dump too after they parse the data out of it. So the CSRSVC, again, it dumps the memory of a particular process. This last piece, inetmgr, that is the piece that actually looks at the dump.
26:20
So if a dump is 500 megabyte, attackers don't want to transfer 500 megabytes because, guess what, at a grocery store or a bar, the bandwidth is not that awesome. So they don't want 500 megs of data coming for like four credit cards. So what they do is they write this application, which is like a Perl application. They've converted it to EXE, with Perl to EXE.
26:42
And this piece actually looks at the dump files, and it parses out only tracked data. And then this is the piece that actually does the encryption and some other features, which I'm going to show in a minute. So without further ado, we're going to run this memory dumper malware.
27:02
Okay, so see these files, winboot.exe. So this is winboot.exe. So basically the malware writers, they actually followed a lot of good coding skills. So the installation for this malware is basically an install switch. winboot.exe slash install.
27:22
And guess what you see? Windows bootloader installed. You know what, I want to show you something really cool, which I love about these malware writers. They try to freak you out. So what you're going to see when you see the service, Windows boot, yeah, so this is the one.
27:41
So as you can see, the path to the executable is the path that we were in, winboot.exe. And guess what it says? It manages the loading of the Microsoft Windows operating system. Right? And better yet, if this service is disabled, the Microsoft Windows operating system will fail to start.
28:02
So this is the first year that they've got all the spellings right. They usually mess up on the spellings. So it's a huge cheer for those writers here. Okay, so now that this malware is installed as a service, we have to run this. As I said, they wrote the code brilliantly.
28:20
They also have a debug feature to this. So I think someone was queuing their code. Alright, so we're going to run this in debug mode. And what you're going to see here is basically, these two pieces haven't started yet, right? So when I run it in debug mode, there's going to be two new processes. And you're going to see that right on the system tray here.
28:44
Alright, so winboot.exe, hey, I want to see debug. So now, as you can see, there's a new process, CSRSVC. And also, the inetmgr, right? So I don't know if you can see it that far. It's saying, basically it says state loading, please wait.
29:03
State monitoring. So the malware is kind of saying, okay, you know what, I'm ready to do the dirty work, but you've got to do something for me to do anything. So right now, the malware is just sitting idle. I mean, it's monitoring, but it's not showing any output, because we haven't processed any of the sensitive data.
29:20
So as soon as we do that, you should see something here. Okay, so I need a volunteer here who's going to come to our bar. And as you can see, we have a pretty cool bar, the whiskey bar. So who wants to come to the whiskey bar? There you go. We've got a brave soul here. Yeah, yeah, come on up.
29:41
Okay, so while he's coming, because this is not a point of sale application, we don't have a payment processing application here. So we're going to trick the system. We're going to say, let textpad be our payment application. So instead of textpad.exe, I'm going to say become pbtsrv.exe.
30:05
So textpad is our payment application. So I'm going to open this, and now I'm going to ask our volunteer to actually swipe a card. Actually, what kind of beer would you like? This is a bar, so... Bud Light. So he wants Bud Light, and sorry, I couldn't provide a cuter bartender, but...
30:23
Okay, swipe the card. I'll help you out. Okay. So I want to show you that this guy wants a lot of beer. Want a real? Do you want to use a real one? No, no, no. Well, this is a gift card, so... Well, this is a gift card. Okay.
30:40
Okay. Go for it. Here you go. All right. There we go. What does it say? A gift for you. A gift for you. Awesome. Okay. There you go. Thank you very much. We don't have Bud Light today, but, you know, you still want to... Here you go. You get a t-shirt. So he gets a t-shirt. Thank you so much for volunteering.
31:03
Okay. So now we have got this data. Obviously, pbtsrv, now if we watch these processes, it says, hey, can anybody read it? It says, hey, in this memdump folder, there is a dump file. And in that dump file, I found track one data.
31:24
Right? So we're going to go to our folder, which has... So now, notice there are two new things here. Memdump and inetinfo. See that? Okay. So one thing I want to show you, this is a really, really key feature. Inetinfo is actually the malware output file.
31:41
But notice that the time on it is June 1st, 2005. Right? And not only the modified time, but the create time is also June 1st, 2005. So if you're looking for more recent changes to your system, you know, you're not going to detect this file, right? Because this...
32:00
And basically, we just wrote data to it. So as we modified, we didn't see anything here. So let's actually check this out, the data in this file. I'm going to open it with Notepad. And guess what you see? Garbage. It's just, you know, that data is encrypted. So what I'm going to do is go to my Spyderless script files
32:22
and basically show the desktop. So I'm going to run the decrypter. Got them all selected. Okay. Well, there we go. Freak tools, maybe? Yeah. There you go. Spyder Labs, iNet decrypt.
32:41
And I'm going to copy that to memory dumper. All right. So... Okay. So this is my script that's going to decrypt the data that we saw. And let's say that I want to feed inetinfo.chm file and then the output file, the name I'm going to give is decrypteddata.txt.
33:07
Okay? So let's see what decrypted data has. So basically, that's how neat the output is. It basically says memdump pbtsrv.exe2992.
33:21
That's the process ID. And actually, you know what? I'm going to open it for a better viewing. There you go. All right. So basically, you know, it's not the hacker saying, trust me, Spyder Labs 2001. That's our script.
33:40
And memdump and then pbtsrv.exe2992. Mr. John Smith's credit card is here. Not only track one data, but track two data as well. So that's about it for the memory dumper malware. And we're going to move on to the next one.
34:02
And when we talk about these hitting you personally, I actually once got a call from Gibran who asked, were you at this club in Las Vegas last July? And is your credit card ending these four digits? And I said, well, why? And he said, well, you probably needed to call your credit card company. Your credit card was exposed in this breach.
34:21
So that does happen from time to time. So the next one we have here, and I think we're running a little short on time. So we have two different demos that are remaining. We have this web check dll. And this is basically targeting your work. And this is basically an example of how you hear about critical files being exposed when corporations are having
34:43
data leakage problems. This is a piece of malware that actually will attack that and gain access to it. So we have that demo, and then we also have a mobile demo. And I think the mobile one is pretty short. We can show you that demo in three minutes. But this malware is pretty, pretty soft malware because it only has a dll file.
35:01
So notice when we mentioned that a dll can do a lot of damage, you're going to see that here. So let me show you the malware. It's called the web check dll. Basically, you can install this malware with a simple registry hack. And I'm going to show you what this registry file has. So this is basically the folder in the registry
35:22
that it tries to modify. So I'm going to do it manually so you guys get to see it. So what I want to show you here is that the name of the malware is webcheck.dll, which is also a legitimate Microsoft file. If you mouse over that, you basically see Website Monitor. And it's only 10 KB.
35:42
So, local machine software. I'm going to find this registry key. Okay. So basically, the legitimate file, Windows Explorer, whenever it runs, it basically loads this file, webcheck.dll. But it loads it from system32 folder.
36:03
What our malware, what we're going to do is we're going to copy and paste this file in the Windows folder. And we're going to tell the system to run this file out of Windows folder rather than Windows system32 folder. So it's a pretty simple hack. I just placed a file here.
36:20
So this is the legitimate file. So I'm going to tell the system to basically load the webcheck.dll, but from the Windows folder. So obviously, if you had time, we would have restarted the system and showed you. But I think the quick hack I could show you is if we just close,
36:41
if we end Explorer and reload Explorer, it should work. If it doesn't, we have to cheer louder. Okay. So basically, now when Explorer.exe has started, notice we did the hack. So now Explorer.exe has to load webcheck.dll from Windows folder. So the malicious one.
37:02
Basically, this malware stores the data in the root of the drive. But it has the hidden attributes. Not just the hidden attributes, but also the system attributes. So we have to uncheck this button, which, again, is a Windows no-no. So notice you have this file, page file.
37:21
What's page file in a Windows system? Virtual memory, right? So you're going to see an additional file if everything goes right. So we're going to go to our company Intranet. And it says intranet.mycompany.com. And we're going to try to log into this folder. So it's Smith.
37:40
And then I'm going to type in my password. And it sends me to the Intranet folder. So in the confidential folder, I'm going to upload a file. And that file, basically, you do a lot of activity from your browser. So basically, this malware is targeting your browser. So anything that you're doing in the browser, better watch out because it's trying to steal that.
38:00
So I'm going to put this document there. So let me show you the contents of this document. It basically has some confidential information. It says, President arrives at DEFCON on August 5. We'll attend Spider's party. So we're going to process that to the browser, right? I'm going to upload this file and then go back to my C drive. Do you see page file there?
38:22
Basically, 18K. So right now, it's not exfiltrating any data because the malware writers have coded in the malware itself the time to exfiltrate data. So I'm running a local FTP server. We've kind of passed a malware so that it sends the data to an FTP server, but I'm running it on the local host. So this is where you should see data around 2 a.m.
38:43
So I'm going to change the time to 1.59.50 a.m. so that we get 10 seconds to pray. And basically, the minute it hits 2 o'clock, we should see something.
39:04
Okay. It worked! Awesome. Okay. So we have this file now. Notice the page file disappeared. Now it's only page. The page file's going to come back, but in the meantime, there's a zip file here. So we should be able to extract this file here, right?
39:21
We say extract. It says, hey, no archives found. You're a sucker because this file is not a zip file. So basically, what I'm going to do is copy this file, and I'm going to go to my Ruby folder because that's where we wrote the code. And okay.
39:45
And this is basically the decryption script. So I'm going to put it in the bin folder, and pretty quickly, I am going to run this so you guys actually get to see the data before we have to leave. All right. So see Ruby.in. So I'm going to say Ruby decrypt this,
40:02
and the data is like, I think it starts with a C or something, right? Open C29. Okay. There we go. And I'm going to say decrypted data again. Decrypted.txt. Okay, so the script runs, it tries to decrypt that data,
40:21
and then we go back to the same folder to actually check that, and here we go. So what was the keyword in that file that we can look for? So basically here, you see a file upload, but all that data, malware, basically captured. And you can't open this file.
40:42
Even if you wanted to open this in TextPad, you would see garbage, so you basically have to write a decrypt to actually see any sort of data. So just imagine what we get, what we do in our browsers. We pretty much do everything in our browser, and if the malware is only 10 KB and can take stuff from the browser, it's pretty cool.
41:00
Okay. I'll let you know. When you get this T-shirt, I'll let you know. It's pretty, okay. So I think we're gonna wrap up. It'll be over in Q&A session. Yeah, so for building number four, we'll be in the Q&A session. We may be able to show you some of the last pieces
41:21
of the demo during the Q&A time. We have a mobile malware demo as well that we're trying to fit into this presentation. So basically, we're done, and basically the closing thing here is next year we predict a lot of new, more advanced activities. And thanks for coming. All right, thank you.